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REMARKS 

SUMMARY OF THE AMENDMENTS 

The present application contains twenty-seven (27) claims, numbered 1, 4-6, 11-13, 16-18, 21, 
22, 27-29, 32, 33, 37, 40-42, 47-49, 52, 53 and 57. 

Claim(s) 2, 3, 7, 8, 9, 10, 14, 15, 19, 20, 23, 24, 25, 26, 30, 31, 34, 35, 36, 38, 39, 43, 44, 45, 
46, 50, 51, 54, 55, 56 and 48 have been cancelled. 

Claims 1, 18, 37 and 57 have been amended to incorporate therein the feature of former claim 
3. 

Claims 4, 5, 21, 22, 33, 40 and 41 have been amended for consistency with the amendment to 
claims 1, 18 and 37. 

Claims 13, 29, 48, 49 have been amended to correct typographical errors. 

It is believed that no new matter has been added under the present amendment. 

CLAIM REJECTIONS UNDER 35 USC 1 12 

On page 2 of the Office Action, claims 1-17, 34-35 and 57 were rejected under 35 USC 112, 
second paragraph, as being indefinite. In response, claims 2, 3, 7, 8, 9, 10, 14, 15, 34 and 35 
have been cancelled, rendering the Examiner's rejection moot in respect of these claims. As 
for claims 1, 4, 5, 6, 11, 12, 13, 16, 17 and 57, it is noted that claims 1 and 57 have been 
amended to replace "default route generator" with "default router". It is respectfully 
submitted that claims 1, 4, 5, 6, 11, 12, 13, 16, 17 and 57 meet the requirements of 35 USC 
112 and the Examiner is respectfully requested to withdraw the rejection of claims 1, 4, 5, 6, 
11, 12, 13, 16, 17 and 57. 
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On page 3 of the Office Action, claims 1-58 were rejected under 35 U.S.C. 103(a) as being 
unpatentable over Listen (U.S. Patent Publication No. 2004/0103314). 

Claims 2, 3, 7, 8, 9, 10, 14, 15, 19, 20, 23, 24, 25, 26, 30, 31, 34, 35, 36, 38, 39, 43, 44, 45, 46, 
50, 51, 54, 55, 56 and 48 have been cancelled, rendering the Examiner's rejection moot. As 
regards claims 1, 4-6, 11-13, 16-18, 21, 22, 27-29, 32, 33, 37, 40-42, 47-49, 52, 53 and 57, 
Applicant notes that each of these claims incorporates the feature of former claim 3, thus the 
following discussion will focus on former claim 3 and current claim 1 . 

In the Office Action, the Examiner merely states "[p]er claims 2-4, 7-8 and 9-10, Listen's 
invention is used to prevent common network attacks including virus, worms, etc.". Yet, 
former claim 3 related to "determining a misconfiguration of a network routing table in a 
second network adjacent to said network", which differs significantly from the subject matter 
seemingly examined by the Examiner. Thus, with respect, the Examiner's approach is 
contrary to the basic tenet that "in a rejection based on 35 U.S.C. 103, the reference teachings 
must somehow be modified in order to meet the claims" (see MPEP §706.02 V), since the 
Examiner has not shown how the limitations of former claim 3 are "met" by the Liston or any 
modification thereto. 

Furthermore, the Examiner has not actually provided any reasoning as to why claim 3 would 
actually be obvious in light of the prior art. As such, it is respectfully submitted that the 
Examiner's rejection is not viable under Ex parte Clapp, 227 USPQ 972, 973 (Bd. Pat. App. 
& Inter. 1985), where it was stated that "[t]o support the conclusion that the claimed invention 
is directed to obvious subject matter, either the references must expressly or impliedly suggest 
the claimed invention or the examiner must present a convincing line of reasoning as to why 
the artisan would have found the claimed invention to have been obvious in light of the 
teachings of the references" (MPEP §706.02(j)). 

Moreover, the Examiner has not established any framework for the objective analysis for 
determining obviousness under 35 USC 103, as "reiterated by the Supreme Court in KSR [... 
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and ...] stated in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966)" (MPEP 
§2141). 

The Examiner is respectfully reminded that the MPEP explicitly mentions that "It is important 
for an examiner to properly communicate the basis for a rejection so that the issues can be 
identified early and the applicant can be given fair opportunity to reply" (MPEP §706.02(j)). 
With respect, it would appear that the Examiner's basis for the rejection of former claim 3 
(which would now be directed at amended claim 1 instead of former claim 3) has not been 
"properly communicate[d]". 

Applicant therefore respectfully requests reconsideration on the above grounds. As such, if 
the Examiner maintains the rejection of former claim 3 (which would now be directed at 
amended claim 1 instead of former claim 3), then the Examiner is respectfully requested to 
provide proper support for such rejection. 

Notwithstanding the above, Applicant nevertheless traverses the rejection, and submits that the 
aforementioned claims distinguish clearly and patentably over Liston, as set forth herein 
below. 

Claim 1 

Claim 1 is reproduced below for the Examiner's convenience: 

1 . A system for analyzing network traffic comprising: 

a plurality of subscriber units and a default router interconnected by a first network, 
said first network operable to direct routed traffic to an appropriate subscriber unit and 
further operable to direct unrouted traffic to said default router; and 
an analyzer connected to said default router for detennining a misconfiguration of a 
network routing table in a second network adjacent to said first network based on 
patterns of activity within said unrouted traffic. 
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It is respectfully submitted that Liston does not teach or suggest "determining a 
misconfiguration of a network routing table in a second network adjacent to said first network 
based on patterns of activity within said unrouted traffic". 

More specifically, Liston discloses a system and method for network intrusion prevention (see 
Title). Specifically, "an inbound data packet 10 created by an external network IP address or a 
local IP address attempts to communicate with a local IP address within the computer 
network. The border router or local computer generates an ARP packet 20 to find the IP 
address that the packet targets" (par. [0036]). Then, "[i]f a computer at the target IP address 
does not respond to the ARP packet, the method and system of the claimed invention sends a 
forged ARP response 60, which creates the appearance that a real machine is associated with 
the previously unused IP address" (par. [0037]). Of note is the fact that "[I]f the source IP 
address [of a subsequent IP packet] is not on the bad guy list and the target IP address is 
virtually occupied by the method and system, the source IP address is added to the bad guy list 
160 if the source IP address is not listed on an override table 170" (par. [0040]). 

Liston proposes various countermeasures "to prevent unauthorized users from connecting to 
IP addresses associated with real computers or to slow or capture an unauthorized users' 
automated scan of a computer network containing unused IP addresses" (par. [0042]). 
Subsequently, "[fjhe bad guy lists from each of the LaBrea TM system 4 are then aggregated 
240 to form a global bad guy list 250 to be transmitted 260 back to each individual LaBrea 
TM system 4 via the Internet" (par. [0045]). 

From these and other passages in Liston, it is clear that Liston merely creates "bad guy lists", 
and does not carry out any analysis on "patterns of activity within [...] unrouted traffic". 
Without any such analysis, Liston is naturally precluded from detennining whether or not 
there has been a misconfiguration of a network routing table in a second network. 

In contrast, the claimed invention comprises an analyzer that is connected to a default router 
(to which unrouted traffic is directed by a first network) and which determines a 
misconfiguration of a network routing table in a second network adjacent to the first network 
based on patterns of activity within the unrouted traffic . Understanding of this feature may be 
assisted by reformulating the example from paragraphs [0057] to [0062] of the present 
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application. (Naturally, this example is only for illustrative purposes and is not to be 
interpreted as limiting the invention as defined by the claim language. Applicant is merely 
providing an illustration, not reading limitations into the claims.) In particular, let unrouted 
packets in a first network be captured by the default router and logged by the analyzer. Now 
suppose that analysis of the patterns of activity of the unrouted traffic reveals that some of the 
unrouted traffic captured by the default router is associated with certain source IP addresses 
that belong to devices in a second (adjacent) network that is operated by a different service 
provider. A misconfiguration of the routing table in the second network is thus determined, 
such misconfiguration having caused unrouted traffic to enter the first network when in fact it 
ought not to have. 

It is noted that the capability of determining a network routing table misconfiguration does not 
exist anywhere in Liston. Rather, Liston is merely concerned with identifying "bad guys" in 
the equivalent of the claimed "first network". Specifically, in Liston, the source IP address 
associated with an unused target IP address will find itself on the bad guy list in a more or less 
automatic fashion, without any analysis of "patterns of activity within the unrouted traffic" 
having been performed. Moreover, no such analysis is conducted in Liston to determine 
anything even remotely resembling a "misconfiguration of a network routing table in a second 
network adjacent to the first network". 

Thus, not only is it clear that Liston fails to disclose all the elements of claim 1, but it should 
also be apparent that the differences between the claimed invention and the cited art are 
beyond the level of ordinary skill in the art. The Examiner is therefore respectfully requested 
to withdraw the rejection of claim 1. 

Claims 18. 37 and 57 

These claims include language similar to that of claim 1 and therefore it is respectfully 
submitted that claims 18, 37 and 57 distinguish clearly and patentably over Liston for the 
same reasons as those set forth above in respect of claim 1. The Examiner is therefore 
respectfully requested to withdraw the rejection of claims 18, 37 and 57. 
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It is noted. that each of claims 4-6, 11-13, 16, 17, 21, 22, 27-29, 32, 33, 40-42, 47-49, 52 and 
53 depends from one of claims 1, 18 and 37 and, as such, incorporates by reference all the 
features contained therein, including those that confer patentability to the respective base 
claim over Liston. The Examiner is therefore respectfully requested to withdraw the rejection 
of claims 4-6, 11-13, 16, 17, 21, 22, 27-29, 32, 33, 40-42, 47-49, 52 and 53. 



13 



Serial No. 10/699,685 

Response to Office Action of November 28, 2008 



Patent 

Attorney Docket No.: 86503-72 



CONCLUSION 



In view of the foregoing, Applicant is of the view that claims 1, 4-6, 1 1-13, 16-18, 21, 22, 27- 
29, 32, 33, 37, 40-42, 47-49, 52, 53 and 57 are in allowable form. Favourable reconsideration 
and withdrawal of all rejections is respectfully requested. Early allowance of the Application 
is earnestly solicited. 

If the application is not considered to be in full condition for allowance, for any reason, the 
Applicant respectfully requests the constructive assistance and suggestions of the Examiner 
for placing the application in allowable condition as soon as possible and without the need for 
further proceedings. 



Date: May 28, 2009 
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